Guide
Authentication
API keys and how to keep them safe.
Every request authenticates with a bearer key created in the dashboard:
Authorization: Bearer eroq_sk_…
Anatomy of a key
eroq_sk_4f7a…c21e
eroq_sk_ — the prefix. It marks the string as an eroq secret key, so leaked-credential scanners (and your own grep) can spot it.
4f7a…c21e — the secret itself. Shown once at creation; we keep only a SHA-256 hash.
Keys are secrets with your balance attached. Three rules keep them boring:
- Server-side only. A key in browser or mobile code is public within the hour. Proxy calls through your backend.
- One key per surface. Keys are free (up to 10) and revoke independently — give staging its own so rotating production never breaks it.
- Revoke, don't delete history. Revocation is immediate; the key's past usage stays in your ledger.
Lost a key?
It cannot be shown again — we never stored it. Mint a replacement on the keys page and revoke the old one; the swap takes under a minute.